CN115576732A - Root cause positioning method and system - Google Patents
Root cause positioning method and system Download PDFInfo
- Publication number
- CN115576732A CN115576732A CN202211427061.7A CN202211427061A CN115576732A CN 115576732 A CN115576732 A CN 115576732A CN 202211427061 A CN202211427061 A CN 202211427061A CN 115576732 A CN115576732 A CN 115576732A
- Authority
- CN
- China
- Prior art keywords
- virtual machine
- information
- abnormal
- data
- historical
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 76
- 230000002159 abnormal effect Effects 0.000 claims abstract description 251
- 230000008859 change Effects 0.000 claims abstract description 185
- 238000012216 screening Methods 0.000 claims abstract description 15
- 238000004364 calculation method Methods 0.000 claims description 17
- 230000000052 comparative effect Effects 0.000 claims description 12
- 230000010354 integration Effects 0.000 claims description 9
- 230000004044 response Effects 0.000 claims description 7
- 238000001514 detection method Methods 0.000 claims description 4
- 238000012545 processing Methods 0.000 description 22
- 238000004458 analytical method Methods 0.000 description 16
- 238000012423 maintenance Methods 0.000 description 14
- 238000013024 troubleshooting Methods 0.000 description 13
- 238000004590 computer program Methods 0.000 description 12
- 238000010586 diagram Methods 0.000 description 10
- 230000008569 process Effects 0.000 description 6
- 230000002776 aggregation Effects 0.000 description 5
- 238000004220 aggregation Methods 0.000 description 5
- 230000008030 elimination Effects 0.000 description 5
- 238000003379 elimination reaction Methods 0.000 description 5
- 230000005856 abnormality Effects 0.000 description 4
- 238000007726 management method Methods 0.000 description 4
- 238000012163 sequencing technique Methods 0.000 description 4
- 230000004807 localization Effects 0.000 description 3
- 238000007619 statistical method Methods 0.000 description 3
- 230000005540 biological transmission Effects 0.000 description 2
- 238000004422 calculation algorithm Methods 0.000 description 2
- 238000004891 communication Methods 0.000 description 2
- 238000001914 filtration Methods 0.000 description 2
- 101000762967 Homo sapiens Lymphokine-activated killer T-cell-originated protein kinase Proteins 0.000 description 1
- 102100026753 Lymphokine-activated killer T-cell-originated protein kinase Human genes 0.000 description 1
- 230000001413 cellular effect Effects 0.000 description 1
- 238000006243 chemical reaction Methods 0.000 description 1
- 238000007405 data analysis Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 229910052731 fluorine Inorganic materials 0.000 description 1
- 125000001153 fluoro group Chemical group F* 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 238000011850 initial investigation Methods 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 238000005259 measurement Methods 0.000 description 1
- 238000013508 migration Methods 0.000 description 1
- 230000005012 migration Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 108090000623 proteins and genes Proteins 0.000 description 1
- 239000004984 smart glass Substances 0.000 description 1
- 238000013519 translation Methods 0.000 description 1
- 230000001960 triggered effect Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/079—Root cause analysis, i.e. error or fault diagnosis
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0706—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment
- G06F11/0709—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0706—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment
- G06F11/0712—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment in a virtual computing platform, e.g. logically partitioned systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
- G06F2009/45591—Monitoring or debugging support
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Quality & Reliability (AREA)
- Software Systems (AREA)
- Health & Medical Sciences (AREA)
- Biomedical Technology (AREA)
- Computer Hardware Design (AREA)
- Mathematical Physics (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The embodiment of the specification provides a root cause positioning method and a system, wherein the root cause positioning method comprises the following steps: acquiring flow change information of virtual machines in a virtual machine cluster at a fault time point; screening candidate virtual machines from the virtual machine cluster according to the flow change information, and loading historical data of the candidate virtual machines connected with the fault time point; determining abnormal information of the candidate virtual machine in a preset root cause positioning dimension according to the historical data; determining a target virtual machine among the candidate virtual machines based on the exception information.
Description
Technical Field
The embodiment of the specification relates to the technical field of data analysis, in particular to a root cause positioning method and system.
Background
With the development of internet technology, a great number of enterprises and individual users have chosen to put services in a cloud network. With the continuous expansion of the scale of the cloud network, the operation, maintenance and management of the cloud network gradually become a new technical challenge. Shared resource type services commonly exist in cloud networks, such as NAT (Network Address Translation) services purchased by users, shared bandwidth, shared traffic packets, dedicated line services, and the like. The shared resource type service brings new challenges to network operation and maintenance while bringing low-cost and efficient management service to users. When the shared resource is abnormal, in the prior art, although the abnormal virtual machine host can be positioned by methods such as flow statistics and data aggregation analysis, the accuracy is low, and the abnormal virtual machine host can be positioned only after operation and maintenance personnel participate in part of scenes, so that the optimal fault removal time is easily missed, and the shared resource is influenced. Therefore, an effective solution to solve the above problems is desired.
Disclosure of Invention
In view of this, the embodiments of the present disclosure provide a root cause positioning method. One or more embodiments of the present disclosure also relate to a root cause positioning apparatus, a root cause positioning system, a server, a computer readable storage medium, and a computer program, so as to solve the technical drawbacks of the prior art.
According to a first aspect of embodiments of the present specification, there is provided a root cause positioning method, including:
acquiring flow change information of virtual machines in a virtual machine cluster at a fault time point;
screening candidate virtual machines from the virtual machine cluster according to the flow change information, and loading historical data of the candidate virtual machines connected with the fault time point;
determining abnormal information of the candidate virtual machine in a preset root cause positioning dimension according to the historical data;
determining a target virtual machine among the candidate virtual machines based on the exception information.
According to a second aspect of embodiments herein, there is provided a root cause localization apparatus comprising:
an information acquisition module configured to acquire traffic change information of virtual machines in a virtual machine cluster at a failure time point;
a data loading module configured to screen candidate virtual machines from the virtual machine cluster according to the flow change information, and load historical data of the candidate virtual machines connected with the fault time point;
the determining information module is configured to determine abnormal information of the candidate virtual machine in a preset root cause positioning dimension according to the historical data;
a determine virtual machine module configured to determine a target virtual machine among the candidate virtual machines based on the exception information.
According to a third aspect of embodiments herein, there is provided a root cause positioning system, comprising:
the storage node is used for acquiring the flow change information of the virtual machines in the virtual machine cluster at the fault time point; screening candidate virtual machines from the virtual machine cluster according to the flow change information, reading historical data of the candidate virtual machines connected with the fault time point, and sending the historical data to a computing node;
the computing node is used for receiving the historical data and determining the abnormal information of the candidate virtual machine in a preset root cause positioning dimension according to the historical data; determining a target virtual machine among the candidate virtual machines based on the exception information.
According to a fourth aspect of embodiments herein, there is provided a server comprising:
a memory and a processor;
the memory is configured to store computer-executable instructions which, when executed by the processor, implement the steps of the root cause positioning method described above.
According to a fifth aspect of embodiments herein, there is provided a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the above-described root cause localization method.
According to a sixth aspect of embodiments herein, there is provided a computer program, wherein the computer program, when executed in a computer, causes the computer to perform the steps of the above-mentioned root cause positioning method.
In order to efficiently and accurately locate a failed virtual machine, the root cause locating method provided in this specification may first obtain flow change information of virtual machines in a virtual machine cluster at a failure time point, preliminarily exclude non-failed virtual machines according to the flow change information, thereby selecting a candidate virtual machine from the virtual machine cluster, and may load historical data of the candidate virtual machine at a failure time point in order to ensure the locating accuracy, thereby reducing the computational resources consumed by determining whether each virtual machine in the cluster has a failure one by one; after the historical data is loaded, the abnormal information of the candidate virtual machine in the preset root cause positioning dimension can be determined according to the historical data, so that whether the candidate virtual machine has a fault or not can be analyzed according to the abnormal information, the target virtual machine can be determined in the candidate virtual machine according to the abnormal information, and the host machine capable of positioning the target virtual machine can be used for conducting fault elimination processing. High precision can be achieved while high efficiency is achieved, the time consumed by operation and maintenance personnel for troubleshooting is greatly reduced, and the troubleshooting efficiency is effectively improved.
Drawings
Fig. 1 is a schematic diagram of a root cause location method provided in an embodiment of the present specification;
FIG. 2 is a flow chart of a method for root cause location provided by an embodiment of the present disclosure;
fig. 3 is a flowchart of determining flow change information in a root cause locating method according to an embodiment of the present disclosure;
fig. 4 is a block diagram illustrating a root cause location method according to an embodiment of the present disclosure;
FIG. 5 is a flowchart illustrating a processing procedure of a root cause location method according to an embodiment of the present disclosure;
FIG. 6 is a schematic structural diagram of a root cause positioning device according to an embodiment of the present disclosure;
FIG. 7 is a block diagram of a root cause location system according to an embodiment of the present disclosure;
fig. 8 is a block diagram of a server according to an embodiment of the present disclosure.
Detailed Description
In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present description. This description may be embodied in many different forms and should not be construed as limited to the embodiments set forth herein, as those skilled in the art will be able to make and use the present disclosure without departing from the spirit and scope of the present disclosure.
The terminology used in the description of the one or more embodiments is for the purpose of describing the particular embodiments only and is not intended to be limiting of the description of the one or more embodiments. As used in one or more embodiments of the present specification and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used in one or more embodiments of the present specification refers to and encompasses any and all possible combinations of one or more of the associated listed items.
It should be understood that although the terms first, second, etc. may be used herein in one or more embodiments to describe various information, these information should not be limited by these terms. These terms are only used to distinguish one type of information from another. For example, a first can also be referred to as a second and, similarly, a second can also be referred to as a first without departing from the scope of one or more embodiments of the present description. The word "if" as used herein may be interpreted as "at" \8230; "or" when 8230; \8230; "or" in response to a determination ", depending on the context.
In the present specification, a root cause location method is provided, and the present specification relates to a root cause location device, a root cause location system, a server, a computer readable storage medium, and a computer program, which are described in detail in the following embodiments one by one.
In practical application, when there is an abnormality in a shared resource, a virtual machine host with the abnormality needs to be located to eliminate the fault, and in the prior art, statistics based on traffic Top N, aggregation analysis based on Session data, an analysis method based on machine learning, an aggregation method based on statistical analysis, and the like are mostly adopted. (1) statistical method based on flow Top N: when the egress traffic is abnormal, the N virtual machines with the highest traffic rank are counted as possible abnormal root causes. But this method is only applicable to the case where the flow is smooth and the anomaly type is a sharp spike-type anomaly. The actual network traffic time sequence tends to have higher complexity and uncertainty, and the anomaly types also include steep drop, high frequency jitter and other types, so the method has a limited application range. (2) Session data-based aggregation analysis: the network traffic outlet NAT gateway is provided with Session statistical information with finer granularity than single traffic statistical information, and the traffic change condition of the virtual machines can be more accurately converged by counting the flow information of each virtual machine, so that possible abnormal root causes of the virtual machines can be analyzed. However, session data is huge in scale, if root cause analysis is performed based on the Session data, more storage space is needed and more cost is needed compared with a method based on outlet traffic statistical analysis of a virtual machine, and effective expansion is difficult to perform with continuous expansion of cloud network scale. Although other methods can perform root cause localization, the efficiency and the timeliness are low, and therefore an effective solution is needed to solve the above problems.
Referring to the schematic diagram shown in fig. 1, in order to efficiently and accurately locate a failed virtual machine, the root cause locating method provided in this specification may first obtain flow rate change information (resource change curve) of virtual machines in a virtual machine cluster at a failure time point, preliminarily exclude non-failed virtual machines according to the flow rate change information, thereby selecting a candidate virtual machine in the virtual machine cluster, and in order to ensure the locating accuracy, may load historical data of the candidate virtual machine at the failure time point, thereby reducing the computational resources consumed by determining whether each virtual machine in the cluster has a failure one by one; after the historical data is loaded, the abnormal information of the candidate virtual machine in the preset root cause positioning dimension can be determined according to the historical data, so that whether the candidate virtual machine has a fault or not can be analyzed according to the abnormal information, the target virtual machine can be determined in the candidate virtual machine according to the abnormal information, and the host machine capable of positioning the target virtual machine can be used for conducting fault elimination processing. High precision can be achieved while high efficiency is achieved, the time consumed by operation and maintenance personnel in troubleshooting is greatly reduced, and the troubleshooting efficiency is effectively improved.
Fig. 2 shows a flowchart of a root cause location method according to an embodiment of the present disclosure, which specifically includes the following steps.
Step S202, acquiring the flow change information of the virtual machines in the virtual machine cluster at the failure time point.
The root cause positioning method provided by the embodiment is applied to a server side for providing shared resources; the shared resources provided by the server include but are not limited to shared bandwidth, shared traffic packets, private line services, etc.; when the shared resource is abnormal, it is impossible to provide a good service for the user or the enterprise, the root reason is that the virtual machine host providing the shared resource fails, and the server usually has a large number of hosts to support the virtual machine operation for providing sufficient shared resource. When a host fails, the host with the fault is difficult to accurately position in a short time for removing the fault; and thus greatly affect the business services of the user or enterprise. In order to solve the above problems, the root cause positioning method provided by this embodiment can quickly and accurately position the target virtual machine host, so as to assist the operation and maintenance personnel in troubleshooting, reduce the influence caused by the fault, and improve the use experience of the user or the enterprise.
Specifically, the failure time point is a time point when the host fails, and the shared resource traffic will fluctuate at the time point. Correspondingly, a virtual machine cluster specifically refers to a set formed by all virtual machines provided by a server, and is used for providing shared resources for users or enterprises. Correspondingly, the traffic change information specifically refers to traffic change difference information of each virtual machine in the virtual machine cluster before and after the failure time point, and is used for preliminarily judging whether the host to which the virtual machine belongs is the failed host. That is to say, the traffic change information can reflect the change situation of each virtual machine before and after the failure time point, and can preliminarily reflect whether the host machine fails or is abnormal.
Based on this, the total flow of the shared resources of the entire virtual machine cluster and the flow of the shared resources corresponding to each virtual machine change with time, so assuming that the time sequence of the flow of the shared resources corresponding to the virtual machine cluster is y (t) and the flow of the virtual machines in the shared resources is X (t), the total flow set X = { X = of all the virtual machines in the gateway 1 (t),x 2 (t)…x n (t), where n is the number of virtual machines. Since the shared resource traffic is composed of all virtual machine traffic, it can be found that y (t) = x 1 (t)+x 2 (t)+…+x n (t)。
On the basis, the shared resources can be shared by a large number of virtual machines in a practical application scene. If the flow of each virtual machine needs to be calculated and analyzed when a fault occurs, a large amount of resources are consumed, the transmission of data in the network also consumes a large amount of time, and the running time of the algorithm linearly increases along with the increase of the number of the virtual machines, so that the fault locating is very unfavorable, and the optimal fault clearing time can be missed. Meanwhile, the traffic change of the shared resource at any time except special time (such as shopping preferential days) is stable for the server, and even if the difference exists, the difference is within a controllable range. When the difference between the flow of the shared resource at a certain moment and the flow of the shared resource at the front and the rear is large, the occurrence of a fault can be preliminarily judged, and a root cause positioning method can be triggered at the moment to realize the positioning of a fault host. That is, the change before and after y (t) at a certain moment is large, and when the change exceeds a set threshold, the host with the fault can be preliminarily determined, and subsequent root cause positioning processing can be performed.
Further, considering that the determination of the failure time point is the basis of the root cause positioning, if the location of the failure time point is not accurate enough, a large amount of computing resources may be wasted, and therefore, when the failure time point is determined, the computing may be performed by reading the shared resource traffic information of the virtual machine cluster, in this embodiment, as shown in fig. 3, the specific implementation manner is as shown in step S2022 to step S2026.
Step S2022, determine the virtual machine cluster corresponding to the shared resource dimension, and read the shared resource traffic information of the virtual machine cluster.
Step S2024, calculating a cluster traffic variation value corresponding to at least one set time point of the virtual machine cluster according to the shared resource traffic information.
Step S2026, determining the failure time point in the at least one set time point according to the cluster traffic variation value, and obtaining traffic variation information of the virtual machines in the virtual machine cluster at the failure time point.
Specifically, the shared resource dimension specifically refers to a dimension corresponding to different shared resources, and when determining the failure time point, the virtual machine cluster associated with the shared resource dimension may be determined first, and then the determination is completed by reading the traffic information of the cluster. Correspondingly, the shared resource traffic information specifically refers to shared resource traffic information of the virtual machine cluster in a set time interval, which is the sum of traffic information of each virtual machine in the set time interval. For example, if the shared resource is a bandwidth resource, the traffic information of the shared resource is the sum of the traffic of the data transmitted by the bandwidth resource. Correspondingly, the setting of the time point specifically refers to a time point for detecting whether a host with a fault exists, and the time point may be an absolute time point set according to an actual requirement, or a relative time point, and the embodiment is not limited herein. Correspondingly, the cluster traffic change value specifically refers to a difference value between changes of the traffic information of the shared resource before and after each set time point.
Based on this, in order to accurately determine the failure time point, a virtual machine cluster corresponding to the shared resource dimension may be determined first, and then the shared resource traffic information corresponding to the virtual machine cluster in a preset time interval is read, that is, the traffic information sum of all virtual machines in the virtual machine cluster is obtained. Secondly, at least one set time point can be determined, and then a cluster flow change value corresponding to each set time point is calculated according to the shared resource flow information, so that a flow change difference before and after each set time point can be analyzed. On the basis, the set time point with a large difference value can be selected as a fault time point, so that the flow change information of each virtual machine at the fault time point can be acquired subsequently, and the flow change information is preliminarily determined as a fault virtual machine subsequently.
In specific implementation, when the cluster traffic change value corresponding to each set time point is calculated according to the shared resource traffic information, partial shared resource traffic information before and after each set time point may be determined in the shared resource traffic information, and then the partial shared resource traffic information before and after the set time point is subtracted, so that the cluster traffic change value corresponding to each set time point may be obtained. Then comparing the cluster flow change value with a preset threshold value; if the time is greater than or equal to the threshold, the set time point can be considered as a fault time point, and if the time is less than the threshold, the set time point can be considered as a normal time point. Therefore, the fault time point of the host computer can be checked.
That is, when the shared resource corresponding to the virtual machine cluster is abnormal, the traffic may have a difference in quantity before and after the failure time point, that is, when calculating the cluster traffic change value corresponding to each set time point, the following formula (1) may be used to calculate the traffic change value:
wherein,the value of the cluster flow rate change is shown, T is a set time point, and L is a time interval.And indicating the flow information of the shared resource before and after the set time point. When calculating any time point correspondenceThereafter, it may be determined whether there is a host failure at a point in time based on the comparison of the value to a threshold.
The present embodiment describes the above content by taking shared bandwidth resources as an example; determining that a virtual machine cluster corresponding to the shared bandwidth resource comprises n virtual machines, namely a virtual machine 1, a virtual machine 2, 8230and a virtual machine n; firstly, the flow of shared resources of a virtual machine cluster in a T1-T2 time interval is obtained, then, according to a formula (1), a flow difference value in an L time interval before and after a T1 moment is calculated to be C1 by combining the flow of the shared resources, a flow difference value in the L time interval before and after the T2 moment is calculated to be C2, and a flow difference value in the L time interval before and after the T3 moment is calculated to be C3, then, absolute values corresponding to C1, C2 and C3 are compared with a preset fault threshold value C, the C2 absolute value is determined to be greater than C, a fault time point can be determined to be T2, and then, the initial investigation can be completed by counting the flow of each virtual machine at the T2 time point, so that a fault host can be accurately positioned in the following process.
In conclusion, the accuracy of determining the fault time point can be ensured by combining the shared resource flow information to determine the fault time point, so that root cause positioning is supported on the basis, the root cause positioning accuracy is effectively improved, and influence on users or enterprises is avoided.
Furthermore, after the failure time point is determined, considering that the number of virtual machines included in the virtual machine cluster is large, if the failure location is performed on the basis of a full number of virtual machines, a large amount of computing resources will be consumed, so in order to reduce the consumption of computing resources and improve the location accuracy, the flow change information of each virtual machine may be determined first and then preliminary screening may be performed, in this embodiment, the specific implementation manner is as follows:
determining a normal time interval and an abnormal time interval according to the fault time point; acquiring normal flow change information of the virtual machine corresponding to the normal time interval and abnormal flow change information corresponding to the abnormal time interval; and calculating a flow change value according to the normal flow change information and the abnormal flow change information, and using the flow change value as the flow change information corresponding to the virtual machine.
Specifically, the normal time interval specifically refers to a set length time interval before the failure time point, and correspondingly, the abnormal time interval specifically refers to a set length time interval after the failure time point, and the length of the normal time interval is the same as that of the abnormal time interval; correspondingly, the normal traffic change information specifically refers to traffic information of the virtual machine corresponding to the normal time interval; correspondingly, the abnormal traffic change information specifically refers to traffic information of the virtual machine corresponding to the abnormal time interval. Correspondingly, the flow rate change value specifically refers to a difference value between the normal flow rate change information and the abnormal flow rate change information.
Based on this, the determination of the flow change information of any virtual machine in the virtual machine cluster is as follows: after the failure time point is determined, a normal time interval and an abnormal time interval with equal duration can be determined according to the failure time point, and then normal flow change information of the virtual machine corresponding to the normal time interval and abnormal flow change information of the virtual machine corresponding to the abnormal time interval can be obtained and used for reflecting flow conditions of the virtual machine before and after the failure time point. And then, calculating a flow change value according to the normal flow change information and the abnormal flow change information, namely determining the flow change values of the virtual machine before and after the failure time point, and taking the flow change values as the flow change information of the virtual machine.
In specific implementation, the flow rate variation value can be calculated by the following formula (2):
indicating the flow rate change value, T indicating the failure time point, and L indicating the time interval. x is a radical of a fluorine atom i (t) indicates flow rate information before and after the failure time point.
In conclusion, by combining the normal time interval and the abnormal time interval to calculate the flow change value, the flow change information of each virtual machine before and after the failure time point can be accurately determined, and whether the host of the virtual machine has a failure or not can be preliminarily judged in the follow-up process, so that the purpose of reducing the number of troubleshooting objects is achieved.
In addition, when acquiring the normal traffic change information and the abnormal traffic change information corresponding to the virtual machine, in order to facilitate resource management by the server and reduce the calculation pressure of the server, the log server may record the traffic information separately, and read and use the information when it is needed, in this embodiment, the specific implementation manner is as follows:
creating an information reading request according to the normal time interval and the abnormal time interval, and sending the information reading request to a log server corresponding to the virtual machine cluster; receiving initial flow change information fed back by the log server aiming at the information reading request; and determining the normal flow change information and the abnormal flow change information in the initial flow change information.
Specifically, the information reading request specifically refers to a request for reading traffic change information corresponding to the virtual machine in a normal time interval and an abnormal time interval, and the request records a virtual machine identifier, and information of the normal time interval and the abnormal time interval; correspondingly, the log server specifically refers to a server for recording traffic change information of the virtual machine, and is used for maintaining the record and management of the traffic log. Accordingly, the initial traffic change information specifically refers to a sum of the normal traffic change information and the abnormal traffic change information.
Based on the method, after the normal time interval and the abnormal time interval are determined according to the fault time point, an information reading request can be created according to the identification information of the virtual machine, the normal time interval and the abnormal time interval, the information reading request is sent to a log server for recording the cluster flow log of the virtual machine, after the log server receives the information reading request, corresponding information can be obtained through analysis, initial flow change information can be read from a log database according to the information and is fed back to a server, and the server can obtain normal flow change information and abnormal flow change information through analysis of the initial flow change information and is used for calculating the flow change value subsequently.
Along the above example, after the time point t2 is determined as the failure time point, the traffic of the virtual machines corresponding to n virtual machines respectively can be read from the log service, and the traffic information corresponds to time intervals [ t2-L, t2] and [ t2, t2+ L ], that is, L time intervals before and after the failure time point. After the virtual machine flow is obtained, the flow change value corresponding to each virtual machine in the n virtual machines can be calculated according to the formula (2) and the virtual machine flow, and then the virtual machine with high failure probability in the n virtual machines can be analyzed according to the flow change value, and root cause positioning processing is performed.
In conclusion, the flow change information is determined by combining the log server, so that the server maintenance information is more single, more computing resources can be utilized to perform root cause positioning processing, and the accuracy and efficiency of the root cause positioning are further improved.
And S204, screening candidate virtual machines from the virtual machine cluster according to the flow change information, and loading historical data of the candidate virtual machines connected with the fault time point.
Specifically, after the traffic change information corresponding to each virtual machine in the virtual machine cluster is determined, further, considering that the traffic change information can embody traffic fluctuation of the virtual machine before and after a failure time point, and therefore whether the virtual machine has a failure or not can be reflected, preliminary screening processing can be performed in combination with the traffic change information, so that determination of candidate virtual machines in the virtual machine cluster is achieved, and whether the candidate virtual machine is a failed virtual machine or not can be further analyzed by loading historical data of the candidate virtual machine at the failure time point.
The candidate virtual machines are specifically part of virtual machines screened from the virtual machine cluster, and the number of virtual machines can be reduced by screening the candidate virtual machines, so that the efficiency of subsequently updating and positioning the fault virtual machine host in one step is improved. Correspondingly, the historical data specifically refers to data processed or transmitted by the candidate virtual machine in a time interval corresponding to the failure time point. For example, if the shared resource is a bandwidth resource, the historical data is data transmitted by the candidate virtual machine in a time interval corresponding to the failure time point; and if the shared resource is a CPU resource, the historical data is the data processed by the candidate virtual machine in the time interval corresponding to the failure time point.
Further, when screening out a candidate virtual machine, in order to accurately screen out a virtual machine with a higher probability of having a fault in combination with flow change information, the virtual machine may be implemented by calculating an occupation ratio, in this embodiment, a specific implementation manner is as follows:
calculating the ratio of the flow change value corresponding to each virtual machine to the cluster flow change value; sorting the virtual machines in the virtual machine cluster according to the calculation result to obtain a virtual machine queue; and selecting a set number of virtual machines in the virtual machine queue as the candidate virtual machines.
Specifically, the calculation of the ratio can reflect the ratio of the traffic change value of the virtual machine to the cluster traffic change value, and the higher the ratio is, the more likely the ratio is a root cause; correspondingly, the virtual machine queue specifically refers to a queue obtained by sequencing the virtual machines in the virtual machine cluster according to a ratio, and the sequencing mode can be from high to low or from low to high; correspondingly, the setting of the number specifically refers to selecting the number of candidate virtual machines from the queue, and may be set according to actual requirements, which is not limited in this embodiment.
Based on this, after the flow change value corresponding to each virtual machine and the cluster flow change value corresponding to the virtual machine cluster are obtained through the calculation, the ratio of the flow change value corresponding to each virtual machine to the cluster flow change value can be calculated; and obtaining the flow abnormality degree corresponding to each virtual machine according to the ratio calculation result, and sorting the virtual machines from high to low according to the flow abnormality degrees, and then sequentially selecting a set number of virtual machines as candidate virtual machines for subsequent secondary positioning processing.
In practical application, consider if(Cluster traffic variation value) is greater than 0, thenThe larger the traffic change value, the more likely it is to be a root cause. WhileThe less likely to be a root cause, so that the gene can be determinedMay determine the probability of the virtual machine failing. I.e. a determination of candidate virtual machines is made. In addition, considering that the accuracy of the mode based on the calculation ratio sorting selection is low, and the fault virtual machine cannot be accurately positioned, the largest K virtual machines can be selected to enter the subsequent processing. In addition, the virtual machines with the times of TOPK C can be selected as candidate virtual machines to meet the subsequent processing requirements.
It should be noted that when the candidate virtual machines are screened out, the calculation of the numerical value in combination with the flow information is completed, so that the operation of the flow information on the nodes storing the flow information can be completed through the set SQL statement, and the server can directly obtain the result fed back by the nodes, so that the candidate virtual machines are determined from the virtual machine cluster, and the calculation processing operation is completed without data migration.
According to the above example, after the flow change value corresponding to each virtual machine in n virtual machines is determined, the ratio of each flow change value to the sum of the flow change values of the n virtual machines can be calculated, the ratio corresponding to the virtual machine 1 is determined to be L1 according to the calculation result, the ratio corresponding to the virtual machine 2 is determined to be L2 \8230, the ratio corresponding to the virtual machine n is Ln, then the L1-Ln are sequenced from high to low, TOP K C virtual machines can be selected as candidate virtual machines according to the sequencing result, the number of screened virtual machines is m (m is less than n), and therefore the fault virtual machine host can be conveniently located from the m virtual machines.
In summary, the candidate virtual machines are screened out by calculating the occupation ratio, so that the data acquisition and calculation can be performed subsequently without increasing with the increase of the number of virtual machines sharing resources, and the method can be expanded to a scene with a larger virtual machine cluster scale so as to have higher expandability.
Furthermore, after the candidate virtual machine is determined, in order to accurately locate the failed virtual machine in the candidate virtual machine, the method is used to determine the failed host, analysis may be performed from data dimensions, and data associated with the virtual machine generally exists in a preset storage medium, so in order to improve data acquisition efficiency and accelerate root cause location efficiency and accuracy, a multi-thread copy manner may be adopted, and in this embodiment, the specific implementation manner is as follows:
creating a data loading request according to the fault time point, and sending the data loading request to a database corresponding to the candidate virtual machine; starting at least two threads in response to the data loading request, and receiving historical normal data and historical abnormal data fed back by the database aiming at the data loading request through the at least two threads as the historical data.
Specifically, the data loading request is to send a request for reading a failure time point associated with the candidate virtual machine to a database storing data. Correspondingly, the database is specifically a database used for storing processing data or transmission data of the virtual machine, and correspondingly, the historical normal data is specifically data transmitted or processed by the candidate virtual machine within a set time interval before the failure time point; correspondingly, the historical abnormal data specifically refers to data transmitted or processed by the candidate virtual machine within a set time interval after the fault time point; the set time intervals corresponding to the historical normal data and the historical abnormal data are the same in length.
Based on this, after the candidate virtual machines and the failure time point are determined, in order to accurately analyze whether each candidate virtual machine is associated with the failure host, a data loading request can be created according to the failure time point, and the data loading request is sent to a database corresponding to the candidate virtual machine; and then, at least two threads can be started in response to the data loading request, and historical normal data and historical abnormal data fed back by the database aiming at the data loading request are received by the at least two threads to serve as historical data, so that the data acquisition efficiency is improved, and the root cause positioning processing is completed in a short time.
In practical application, after a candidate virtual machine is determined, historical data of a connection fault time point of the candidate virtual machine needs to be pulled to the local for subsequent analysis; therefore, when the data is pulled, the data can be realized in a multi-thread and multi-batch mode. That is, in the historical data acquisition phase, multiple threads can be started simultaneously to continuously pull data, so that the network throughput is improved. Each thread acquires a batch of data instead of one data at a time through network I/O, so that the function of multiplexing connection is achieved, and the time for establishing connection and disconnecting connection is reduced.
Step S206, determining abnormal information of the candidate virtual machine in a preset root cause positioning dimension according to the historical data.
Specifically, after the historical data of the candidate virtual machine and the candidate virtual machine at the failure time point are determined, further, considering that the historical data is data processed or transmitted before and after the failure time point by the candidate virtual machine, the abnormal information of the candidate virtual machine at the preset root cause positioning dimension can be analyzed according to the change of the historical data before and after the failure time point, so as to screen out the target virtual machine according to the abnormal information, and complete the positioning of the failed host machine.
The preset root cause positioning dimension specifically refers to a dimension for analyzing abnormal fluctuation conditions of the candidate virtual machines from at least one dimension, and correspondingly, the abnormal information specifically refers to information for reflecting abnormal degrees of the candidate virtual machines, so that the abnormal degree of each candidate virtual machine can be conveniently determined according to the abnormal information, the candidate virtual machine with the highest abnormal degree can be selected as a target virtual machine, and a host machine to which the candidate virtual machine belongs is a fault host machine.
Further, when determining the abnormal information corresponding to the candidate virtual machine according to the historical data, considering that data before the failure time point is normal data and data after the failure time point is abnormal data, the determination of the abnormal information may be performed in each sub-root location dimension based on the characteristic, and in this embodiment, the specific implementation manner is as follows:
dividing the historical data according to the fault time point to obtain historical normal data and historical abnormal data; determining at least one sub-root cause positioning dimension in preset root cause positioning dimensions, and calculating abnormal information of each sub-root cause positioning dimension according to the historical normal data and the historical abnormal data;
specifically, the historical normal data specifically refers to data processed or transmitted by the virtual machine before the failure time point, and the historical abnormal data specifically refers to data processed or transmitted by the virtual machine after the failure time point. Correspondingly, the sub-root cause location dimension specifically refers to a dimension for detecting the abnormal degree of the candidate virtual machine, and the sub-root cause location dimension includes, but is not limited to, a predicted root cause location dimension, a comparative root cause location dimension, and a similar root cause location dimension; the prediction root cause positioning dimension specifically refers to a dimension for determining the abnormal degree of the candidate virtual machine in a mode of comparing an expected value and an actual value of a prediction abnormal time interval; comparing the root cause positioning dimensionality specifically means determining the dimensionality of the abnormal degree of the candidate virtual machine in a threshold value comparing mode; the similarity root positioning dimension specifically refers to a dimension for determining the abnormal degree of the candidate virtual machine by calculating the curve similarity degree; the abnormal degree information of each dimension is abnormal information.
Based on the method, after historical data of the fault time points corresponding to the candidate virtual machines are obtained, the historical data can be divided according to the fault time points, and therefore historical normal data and historical abnormal data are obtained; then determining at least one sub-root factor positioning dimension in the preset root factor positioning dimensions, and calculating abnormal information of each sub-root factor positioning dimension according to historical normal data and historical abnormal data; and the positioning of the target virtual machine can be completed by combining the abnormal information of each dimension.
In conclusion, the abnormal information of each sub-root positioning dimension is determined by combining the historical normal data and the historical abnormal data, so that the abnormal degree of the candidate virtual machine can be embodied from multiple dimensions, and the target virtual machine can be accurately determined from the candidate virtual machine in the follow-up process.
Furthermore, during root cause analysis, the abnormal information is determined from at least one sub-root cause positioning dimension, and the determination can be divided into an absolute deviation analysis root cause and a relative deviation analysis root cause, so that the abnormal degree of the candidate virtual machine is determined from different angles, and the requirement of subsequently screening the target virtual machine is met. The predicted root cause positioning dimensionality is absolute deviation analysis, and the comparison root cause positioning dimensionality and the similar root cause positioning dimensionality are relative deviation analysis. The determination process of the abnormal information of different dimensions is as follows:
(1) Under the condition that the sub-root cause positioning dimension is the prediction root cause positioning dimension, determining the abnormal information of the prediction root cause positioning dimension comprises the following steps: inputting the historical normal data into a pre-trained flow prediction model to obtain flow expectation information, and determining first flow real information according to the historical abnormal data; and calculating deviation information between the flow expected information and the first flow real information to serve as abnormal information of the candidate virtual machine in the prediction root cause positioning dimension.
Specifically, the flow prediction model is a model capable of predicting an expected flow in a set time interval; correspondingly, the flow expectation information specifically refers to a flow information representation expected to be processed by the candidate virtual machine in a set time interval, wherein the set time interval is an abnormal time interval; correspondingly, the first flow real information specifically refers to a flow information representation of the candidate virtual machine when actually processing data in an abnormal time interval. Correspondingly, the deviation information specifically refers to an absolute deviation obtained by comparing the actual information with the expected information, wherein a larger deviation indicates a larger abnormal degree, and conversely, a smaller deviation indicates a smaller abnormal degree.
Based on this, in the case that the child root cause location dimension is the prediction root cause location dimension, the determination of the abnormal information corresponding to each candidate virtual machine specifically includes: firstly, inputting historical normal data into a pre-trained flow prediction model, and processing through the flow prediction model to obtain flow expectation information corresponding to an abnormal time interval; meanwhile, first flow real information corresponding to the abnormal time interval is determined according to historical abnormal data; and then, calculating the difference value of the two values to obtain the absolute deviation corresponding to the candidate virtual machine, so that the abnormal degree of the candidate virtual machine can be known according to the absolute deviation.
Along the above example, after m candidate virtual machines are determined, the expected value corresponding to the [ t2, t2+ L ] time interval can be predicted according to historical normal data of the candidate virtual machines in the [ t2-L, t2] time interval. And then obtaining the absolute deviation of the candidate virtual machine according to the difference between the real value and the expected value of the candidate virtual machine in the [ t2, t2+ L ] time interval, wherein the absolute deviation is used for representing the abnormal degree of the candidate virtual machine.
That is to say, the expected value of the candidate virtual machine in the abnormal time interval (T, T + L) can be obtained according to the historical normal data by using the moving average method, then the true value of the candidate virtual machine in the abnormal time interval (T, T + L) can be obtained according to the historical abnormal data, and the predicted deviation, namely the absolute deviation d can be obtained by subtracting the expected value and the true value i Is a virtual machine x i The prediction deviation of the fault host is convenient to determine subsequently.
(2) When the sub-root cause location dimension is a comparative root cause location dimension, determining abnormal information of the comparative root cause location dimension includes: generating an abnormal condition according to the historical normal data, and determining second flow real information according to the historical abnormal data; and detecting the second flow real information according to the abnormal condition, and determining the abnormal information of the candidate virtual machine in the comparative root cause positioning dimension according to the detection result.
Specifically, the abnormal condition specifically refers to a threshold value for analyzing the abnormal degree of the candidate virtual machine, and correspondingly, the second traffic real information specifically refers to traffic information representation when the candidate virtual machine actually processes data in the abnormal time interval.
Based on this, in the case that the child root location dimension is the comparative root location dimension, the determining of the abnormal information corresponding to each candidate virtual machine specifically includes: firstly, generating an abnormal condition according to historical normal data, and simultaneously determining second flow real information according to the historical abnormal data; and secondly, detecting the second flow real information by using an abnormal condition, and analyzing the abnormal degree of the candidate virtual machine through the condition, thereby obtaining the abnormal information of the candidate virtual machine in the comparison root cause positioning dimension.
According to the above example, after m candidate virtual machines are determined, fitting calculation can be performed according to historical normal data of the candidate virtual machines in the [ t2-L, t2] time interval, an abnormal threshold value is obtained according to the fitting calculation result, then a true value is determined according to historical abnormal data of the candidate virtual machines in the [ t2, t2+ L ] time interval, and abnormal information of the candidate virtual machines can be determined by comparing the true value with the abnormal threshold value. In specific implementation, the larger the difference between the true value and the abnormal threshold value is, the higher the abnormal degree is.
That is, when performing the relative deviation analysis, the abnormal amplitude may be introduced to measure the abnormal degree of the candidate virtual machine in the abnormal time interval and the normal time interval, and the larger the abnormal amplitude is, the more likely the abnormal amplitude is the root cause. Based on the method, an abnormal threshold value can be obtained according to historical normal data through an extreme value theory, the real value is compared with the abnormal threshold value, the result of the candidate virtual machine between 0 and 1 can be determined according to the comparison result and is marked as a i Represents a virtual machine x i The magnitude of the anomaly.
(3) Under the condition that the sub-root cause positioning dimension is the similar root cause positioning dimension, determining the abnormal information of the similar root cause positioning dimension comprises the following steps: acquiring a first resource change curve corresponding to the virtual machine cluster, and generating a second resource change curve corresponding to the candidate virtual machine according to the historical normal data and the historical abnormal data; and calculating the curve similarity between the first resource change curve and the second resource change curve to serve as the abnormal information of the candidate virtual machine in the similar root cause positioning dimension.
Specifically, the first resource variation curve specifically refers to a shared resource variation curve of the virtual machine cluster. Correspondingly, the second resource change curve specifically refers to a resource change curve of the candidate virtual machine; correspondingly, the curve similarity specifically refers to the similarity between the shared resource change curve and the resource change curve, and a higher similarity indicates a higher abnormal degree of the candidate virtual machine, whereas a lower similarity indicates a lower abnormal degree of the candidate virtual machine.
Based on this, in the case that the child root cause location dimension is the similar root cause location dimension, the determination of the abnormal information corresponding to each candidate virtual machine specifically includes: first, a first resource change curve corresponding to a virtual machine cluster can be obtained, and a second resource change curve corresponding to a candidate virtual machine is generated according to historical normal data and historical abnormal data; and then, by calculating the curve similarity between the first resource change curve and the second resource change curve, the abnormal degree of the candidate virtual machine can be determined and can be used as the abnormal information of the candidate virtual machine in the similar root cause positioning dimension.
According to the above example, after m candidate virtual machines are determined, shared resource curves corresponding to n candidate virtual machines can be determined first, and then virtual machine curves corresponding to the candidate virtual machines are constructed according to historical abnormal data and historical normal data of the candidate virtual machines; and then, calculating the similarity between the virtual machine curve of each candidate virtual machine and the shared resource curve to determine the abnormal information of the candidate virtual machines.
That is, the determination of anomaly information may be accomplished in a manner that introduces a discrete set metric when performing the relative deviation analysis. That is, a virtual machine curve that is more similar to the shared resource curve of the virtual machine cluster, the corresponding virtual machine is more likely to become the root. Therefore, the similarity of two curves can be calculated by using a set similarity algorithm of discrete set measurement to obtain s i Representing curve similarity, i.e. virtual machine x i Curve of shared resourcesThe shape similarity of (3).
To sum up, through carrying out the definite of abnormal information because of the location dimension from the root of difference, can make things convenient for follow-up starting to gather from a plurality of dimensions to accurate location trouble host computer, effectual positioning accuracy and the efficiency of having improved.
Step S208, determining a target virtual machine in the candidate virtual machines based on the abnormal information.
Specifically, after the abnormal information corresponding to the candidate virtual machine is determined, further, the target virtual machine may be determined in the candidate virtual machine in a manner of comparing the abnormal information, and the host to which the target virtual machine belongs is the fault host, and then the device identifier of the fault host is sent to the operation and maintenance personnel, so that the fault host is accurately and efficiently located, and the operation and maintenance personnel can conveniently perform fault removal processing.
Furthermore, considering that the abnormal information corresponds to each sub-root positioning dimension, the positioning may be completed in an integrated manner, that is, the abnormal information of each sub-root positioning dimension may be integrated, and the target virtual machine may be determined in the candidate virtual machine according to an integration result.
Furthermore, when integrating the abnormal information of a plurality of sub-root positioning dimensions, considering that the abnormal information representation mode of each dimension is different, the abnormal information representation mode may be converted into a numerical value and then calculated, so as to screen the target virtual machine according to the calculation result, in this embodiment, the specific implementation manner is as follows:
calculating an abnormal score corresponding to each sub-root factor positioning dimension according to the abnormal information of each sub-root factor positioning dimension; and integrating the abnormal score corresponding to each sub-root positioning dimension, and determining a target virtual machine in the candidate virtual machines according to an integration result.
Specifically, the abnormal score is a score obtained after conversion according to abnormal information and is used for representing the abnormal degree of the candidate virtual machine; based on the above, after the abnormal information of the candidate virtual machine in each sub-root factor positioning dimension is obtained, the abnormal score corresponding to each sub-root factor positioning dimension can be calculated according to the abnormal information of each sub-root factor positioning dimension; and integrating the abnormal scores corresponding to the positioning dimensions of each sub-root factor, namely determining a target virtual machine in the candidate virtual machines according to an integration result so as to position the host to which the target virtual machine belongs as a fault host.
That is, after obtaining the abnormal information of the candidate virtual machine in each dimension according to the predicted root cause positioning dimension, the comparison root cause positioning dimension and the similar root cause positioning dimension, the following steps can be performedAnd (3) calculating the abnormal score corresponding to each candidate virtual machine, then sequencing the abnormal scores according to the sequence from high to low, and selecting H candidate virtual machines as target virtual machines so as to determine a fault host according to the target virtual machines. Wherein λ is used to control the proportion of the anomaly amplitude and the shape similarity.
According to the above example, after the prediction deviation, the abnormal amplitude and the curve similarity are obtained, the abnormal score can be calculated by combining the prediction deviation, the abnormal amplitude and the curve similarity of each candidate virtual machine, then sorting is carried out according to the abnormal scores, o virtual machines can be selected from m candidate virtual machines as target virtual machines according to the sorting result, then hosts to which the o virtual machines belong can be used as fault hosts, and host information is sent to operation and maintenance personnel, so that the operation and maintenance personnel can conveniently detect and remove faults.
Referring to fig. 4, the root cause positioning method provided in the present specification mainly includes three stages, namely curve filtering, data acquisition, and root cause positioning, in the curve filtering stage, curve index aggregation is determined through calculation of abnormal amounts of shared resources to complete rough screening, and the rough screening is completed by a storage node; during data acquisition, data can be pulled from the storage node to the computing node in a multithreading and multi-batch mode, and then the computing node can complete the root cause positioning processing by computing the absolute deviation and the relative deviation. The storage node is specifically a node for storing traffic information and data, and the computing node is specifically a node for performing troubleshooting.
In order to efficiently and accurately locate a failed virtual machine, the root cause locating method provided by the present specification may first obtain flow change information of virtual machines in a virtual machine cluster at a failure time point, preliminarily exclude non-failed virtual machines according to the flow change information, thereby selecting a candidate virtual machine in the virtual machine cluster, and may load historical data of the candidate virtual machine at the failure time point in order to ensure the locating accuracy, thereby reducing the computational resources consumed by determining whether each virtual machine in the cluster has a failure one by one; after the historical data is loaded, the abnormal information of the candidate virtual machine in the preset root cause positioning dimension can be determined according to the historical data, so that whether the candidate virtual machine has a fault or not can be analyzed according to the abnormal information, the target virtual machine can be determined in the candidate virtual machine according to the abnormal information, and the host machine capable of positioning the target virtual machine can be used for conducting fault elimination processing. High precision can be achieved while high efficiency is achieved, the time consumed by operation and maintenance personnel for troubleshooting is greatly reduced, and the troubleshooting efficiency is effectively improved.
In the following, with reference to fig. 5, the root cause positioning method provided in this specification is further described by taking an application of the root cause positioning method in a scene of sharing traffic resources as an example. Fig. 5 is a flowchart illustrating a processing procedure of a root cause location method according to an embodiment of the present specification, and specifically includes the following steps.
Step S502, determining a virtual machine cluster corresponding to the shared resource dimension, and reading the shared resource flow information of the virtual machine cluster.
Step S504, according to the shared resource flow information, a cluster flow change value corresponding to at least one set time point of the virtual machine cluster is calculated.
Step S506, determining a failure time point in at least one set time point according to the cluster flow change value, and acquiring flow change information of the virtual machines in the virtual machine cluster at the failure time point.
Specifically, a normal time interval and an abnormal time interval are determined according to a fault time point; acquiring normal flow change information of the virtual machine corresponding to a normal time interval and abnormal flow change information of the virtual machine corresponding to an abnormal time interval; and calculating a flow change value according to the normal flow change information and the abnormal flow change information to serve as the flow change information corresponding to the virtual machine.
Further, an information reading request is created according to the normal time interval and the abnormal time interval, and the information reading request is sent to a log server corresponding to the virtual machine cluster; receiving initial flow change information fed back by a log server according to an information reading request; and determining normal flow change information and abnormal flow change information in the initial flow change information.
Step S508, calculating a ratio of the traffic variation value corresponding to each virtual machine to the cluster traffic variation value.
Step S510, sorting the virtual machines in the virtual machine cluster according to the calculation result, and obtaining a virtual machine queue.
In step S512, a set number of virtual machines are selected from the virtual machine queue as candidate virtual machines.
Step S514, creating a data loading request according to the failure time point, and sending the data loading request to the database corresponding to the candidate virtual machine.
Step S516, at least two threads are started in response to the data loading request, and the historical normal data and the historical abnormal data fed back by the database in response to the data loading request are received as historical data through the at least two threads.
And step S518, dividing the historical data according to the fault time points to obtain historical normal data and historical abnormal data.
Step S520, at least one sub-root cause positioning dimension is determined in the preset root cause positioning dimensions, and abnormal information of each sub-root cause positioning dimension is calculated according to historical normal data and historical abnormal data.
Specifically, when the sub-root cause location dimension is the prediction root cause location dimension, determining the abnormal information of the prediction root cause location dimension includes: inputting the historical normal data into a pre-trained flow prediction model, obtaining flow expectation information, and determining first flow real information according to the historical abnormal data; and calculating deviation information between the flow expectation information and the first flow real information as abnormal information of the candidate virtual machine in the prediction root cause positioning dimension.
Under the condition that the sub-root cause positioning dimension is the comparative root cause positioning dimension, determining abnormal information of the comparative root cause positioning dimension, wherein the determining comprises the following steps: generating an abnormal condition according to the historical normal data, and determining second flow real information according to the historical abnormal data; and detecting the second flow real information according to the abnormal condition, and determining the abnormal information of the candidate virtual machines in the comparative root cause positioning dimension according to the detection result.
Under the condition that the sub-root cause positioning dimension is the similar root cause positioning dimension, determining the abnormal information of the similar root cause positioning dimension comprises the following steps: acquiring a first resource change curve corresponding to the virtual machine cluster, and generating a second resource change curve corresponding to the candidate virtual machine according to the historical normal data and the historical abnormal data; and calculating the curve similarity between the first resource change curve and the second resource change curve to serve as the abnormal information of the candidate virtual machine in the similar root cause positioning dimension.
Step S522, according to the abnormal information of each sub-root factor positioning dimension, calculating an abnormal score corresponding to each sub-root factor positioning dimension.
Step S524, integrating the abnormal score corresponding to each sub-root positioning dimension, and determining a target virtual machine in the candidate virtual machines according to an integration result.
In summary, in order to efficiently and accurately locate a failed virtual machine, flow change information of virtual machines in a virtual machine cluster at a failure time point may be obtained first, and non-failed virtual machines are preliminarily excluded according to the flow change information, so as to select a candidate virtual machine in the virtual machine cluster, and in order to ensure the location accuracy, historical data of the candidate virtual machine at the failure time point may be loaded, so as to reduce the computing resources consumed by determining whether each virtual machine in the cluster has a failure one by one; after the historical data is loaded, the abnormal information of the candidate virtual machine in the preset root cause positioning dimension can be determined according to the historical data, so that whether the candidate virtual machine has a fault or not can be analyzed according to the abnormal information, the target virtual machine can be determined in the candidate virtual machine according to the abnormal information, and the host machine capable of positioning the target virtual machine can be used for conducting fault elimination processing. High precision can be achieved while high efficiency is achieved, the time consumed by operation and maintenance personnel in troubleshooting is greatly reduced, and the troubleshooting efficiency is effectively improved.
Corresponding to the above method embodiment, the present specification further provides an embodiment of a root cause positioning device, and fig. 6 shows a schematic structural diagram of a root cause positioning device provided by an embodiment of the present specification. As shown in fig. 6, the apparatus includes:
an obtaining information module 602 configured to obtain traffic change information of virtual machines in a virtual machine cluster at a failure time point;
a loading data module 604 configured to screen candidate virtual machines from the virtual machine cluster according to the flow change information, and load historical data of the candidate virtual machines connected to the failure time point;
an information determining module 606 configured to determine, according to the historical data, abnormal information of the candidate virtual machine in a preset root cause positioning dimension;
a determine virtual machine module 608 configured to determine a target virtual machine among the candidate virtual machines based on the exception information.
In an optional embodiment, the obtain information module 602 is further configured to:
determining the virtual machine cluster corresponding to the shared resource dimension, and reading the shared resource flow information of the virtual machine cluster; calculating a cluster flow change value corresponding to at least one set time point of the virtual machine cluster according to the shared resource flow information; and determining the fault time point in the at least one set time point according to the cluster flow change value, and acquiring flow change information of the virtual machines in the virtual machine cluster at the fault time point.
In an optional embodiment, the obtain information module 602 is further configured to:
determining a normal time interval and an abnormal time interval according to the fault time point; acquiring normal flow change information of the virtual machine corresponding to the normal time interval and abnormal flow change information corresponding to the abnormal time interval; and calculating a flow change value according to the normal flow change information and the abnormal flow change information, and using the flow change value as the flow change information corresponding to the virtual machine.
In an alternative embodiment, the load data module 604 is further configured to:
calculating the ratio of the flow change value corresponding to each virtual machine to the cluster flow change value; sorting the virtual machines in the virtual machine cluster according to the calculation result to obtain a virtual machine queue; and selecting a set number of virtual machines in the virtual machine queue as the candidate virtual machines.
In an optional embodiment, the obtain information module 602 is further configured to:
creating an information reading request according to the normal time interval and the abnormal time interval, and sending the information reading request to a log server corresponding to the virtual machine cluster; receiving initial flow change information fed back by the log server aiming at the information reading request; and determining the normal flow change information and the abnormal flow change information in the initial flow change information.
In an optional embodiment, the load data module 604 is further configured to:
creating a data loading request according to the fault time point, and sending the data loading request to a database corresponding to the candidate virtual machine; starting at least two threads in response to the data loading request, and receiving historical normal data and historical abnormal data fed back by the database aiming at the data loading request through the at least two threads as the historical data.
In an optional embodiment, the determination information module 606 is further configured to:
dividing the historical data according to the fault time point to obtain historical normal data and historical abnormal data; determining at least one sub-root cause positioning dimension in preset root cause positioning dimensions, and calculating abnormal information of each sub-root cause positioning dimension according to the historical normal data and the historical abnormal data;
accordingly, the determine virtual machine module 608 is further configured to:
and integrating the abnormal information of each sub-root cause positioning dimension, and determining a target virtual machine in the candidate virtual machines according to an integration result.
In an optional embodiment, in a case that the sub-root cause location dimension is a predicted root cause location dimension, determining abnormal information of the predicted root cause location dimension includes:
inputting the historical normal data into a pre-trained flow prediction model to obtain flow expectation information, and determining first flow real information according to the historical abnormal data; and calculating deviation information between the flow expected information and the first flow real information to serve as abnormal information of the candidate virtual machine in the prediction root cause positioning dimension.
In an optional embodiment, when the child root cause location dimension is a comparative root cause location dimension, determining abnormal information of the comparative root cause location dimension includes:
generating an abnormal condition according to the historical normal data, and determining second flow real information according to the historical abnormal data; and detecting the second flow real information according to the abnormal condition, and determining the abnormal information of the candidate virtual machine in the comparative root cause positioning dimension according to the detection result.
In an optional embodiment, when the child root cause location dimension is the similar root cause location dimension, determining the abnormal information of the similar root cause location dimension includes:
acquiring a first resource change curve corresponding to the virtual machine cluster, and generating a second resource change curve corresponding to the candidate virtual machine according to the historical normal data and the historical abnormal data; and calculating the curve similarity between the first resource change curve and the second resource change curve to serve as the abnormal information of the candidate virtual machine in the similar root cause positioning dimension.
In an optional embodiment, the determine virtual machine module 608 is further configured to:
calculating an abnormal score corresponding to each sub-root factor positioning dimension according to the abnormal information of each sub-root factor positioning dimension; and integrating the abnormal score corresponding to each sub-root factor positioning dimension, and determining a target virtual machine in the candidate virtual machines according to an integration result.
In order to efficiently and accurately locate a failed virtual machine, the root cause locating device provided by this specification may first obtain flow change information of virtual machines in a virtual machine cluster at a failure time point, preliminarily exclude non-failed virtual machines according to the flow change information, thereby selecting a candidate virtual machine in the virtual machine cluster, and may load historical data of the candidate virtual machine at the failure time point in order to ensure the locating accuracy, thereby reducing the computational resources consumed by determining whether each virtual machine in the cluster has a failure one by one; after the historical data is loaded, the abnormal information of the candidate virtual machine in the preset root cause positioning dimension can be determined according to the historical data, so that whether the candidate virtual machine has a fault or not can be analyzed according to the abnormal information, the target virtual machine can be determined in the candidate virtual machine according to the abnormal information, and the host machine capable of positioning the target virtual machine can be used for conducting fault elimination processing. High precision can be achieved while high efficiency is achieved, the time consumed by operation and maintenance personnel for troubleshooting is greatly reduced, and the troubleshooting efficiency is effectively improved.
The above is a schematic solution of the cause positioning apparatus according to the present embodiment. It should be noted that the technical solution of the root cause positioning device and the technical solution of the root cause positioning method belong to the same concept, and for details that are not described in detail in the technical solution of the root cause positioning device, reference may be made to the description of the technical solution of the root cause positioning method.
Corresponding to the above method embodiment, the present specification further provides an embodiment of a root cause positioning system, and fig. 7 shows a schematic structural diagram of a root cause positioning system provided by an embodiment of the present specification. As shown in fig. 7, the root cause location system 700 includes a storage node 710 and a compute node 720;
the storage node 710 is configured to obtain traffic change information of the virtual machines in the virtual machine cluster at a failure time point; screening candidate virtual machines from the virtual machine cluster according to the flow change information, reading historical data of the candidate virtual machines connected with the fault time point, and sending the historical data to a computing node;
the computing node 720 is configured to receive the historical data, and determine, according to the historical data, abnormal information of the candidate virtual machine in a preset root cause positioning dimension; determining a target virtual machine among the candidate virtual machines based on the exception information.
The above is a schematic solution of the root cause positioning system of the present embodiment. It should be noted that the technical solution of the root cause positioning system and the technical solution of the root cause positioning method belong to the same concept, and details that are not described in detail in the technical solution of the root cause positioning system can be referred to the description of the technical solution of the root cause positioning method.
Fig. 8 is a block diagram illustrating a structure of a server 800 according to an embodiment of the present disclosure. The components of the server 800 include, but are not limited to, a memory 810 and a processor 820. The processor 820 is coupled to the memory 810 via a bus 830, and the database 850 is used to store data.
Server 800 also includes access device 840, access device 840 enabling server 800 to communicate via one or more networks 860. Examples of such networks include a Public Switched Telephone Network (PSTN), a Local Area Network (LAN), a Wide Area Network (WAN), a Personal Area Network (PAN), or a combination of communication networks such as the internet. Access device 840 may include one or more of any type of Network interface (e.g., a Network interface controller) whether wired or Wireless, such as an IEEE802.11 Wireless Local Area Network (WLAN) Wireless interface, a Worldwide Interoperability for Microwave Access (Wi-MAX) interface, an ethernet interface, a Universal Serial Bus (USB) interface, a cellular Network interface, a bluetooth interface, a Near Field Communication (NFC) interface, and so forth.
In one embodiment of the present application, the above-mentioned components of the server 800 and other components not shown in fig. 8 may also be connected to each other, for example, through a bus. It should be understood that the block diagram of the server architecture shown in fig. 8 is for exemplary purposes only and is not intended to limit the scope of the present application. Other components may be added or replaced as desired by those skilled in the art.
The server 800 may be any type of stationary or mobile server, including a mobile Computer or mobile computing device (e.g., tablet, personal digital assistant, laptop, notebook, netbook, etc.), mobile phone (e.g., smartphone), wearable computing device (e.g., smartwatch, smart glasses, etc.), or other type of mobile device, or a stationary server such as a desktop Computer or Personal Computer (PC). The server 800 may also be a mobile or stationary server.
Wherein the processor 820 is configured to execute computer-executable instructions that, when executed by the processor, implement the steps of the root cause positioning method described above.
The above is an illustrative scheme of a server of the present embodiment. It should be noted that the technical solution of the server and the technical solution of the root cause positioning method belong to the same concept, and details that are not described in detail in the technical solution of the server can be referred to the description of the technical solution of the root cause positioning method.
An embodiment of the present specification further provides a computer-readable storage medium storing computer-executable instructions, which when executed by a processor, implement the steps of the root cause positioning method.
The above is an illustrative scheme of a computer-readable storage medium of the present embodiment. It should be noted that the technical solution of the storage medium belongs to the same concept as the technical solution of the root cause positioning method, and for details that are not described in detail in the technical solution of the storage medium, reference may be made to the description of the technical solution of the root cause positioning method.
An embodiment of the present specification further provides a computer program, wherein when the computer program is executed in a computer, the computer program is used to cause the computer to execute the steps of the root cause positioning method.
The above is an illustrative scheme of a computer program of the present embodiment. It should be noted that the technical solution of the computer program is the same concept as the technical solution of the root cause positioning method, and for details that are not described in detail in the technical solution of the computer program, reference may be made to the description of the technical solution of the root cause positioning method.
The foregoing description has been directed to specific embodiments of this disclosure. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims can be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing may also be possible or may be advantageous.
The computer instructions comprise computer program code which may be in source code form, object code form, an executable file or some intermediate form, or the like. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, usb disk, removable hard disk, magnetic disk, optical disk, computer Memory, read-Only Memory (ROM), random Access Memory (RAM), electrical carrier wave signals, telecommunications signals, software distribution medium, and the like. It should be noted that the computer readable medium may contain content that is subject to appropriate increase or decrease as required by legislation and patent practice in jurisdictions, for example, in some jurisdictions, computer readable media does not include electrical carrier signals and telecommunications signals as is required by legislation and patent practice.
It should be noted that, for the sake of simplicity, the foregoing method embodiments are described as a series of acts, but those skilled in the art should understand that the present embodiment is not limited by the described acts, because some steps may be performed in other sequences or simultaneously according to the present embodiment. Further, those skilled in the art should also appreciate that the embodiments described in this specification are preferred embodiments and that acts and modules referred to are not necessarily required for an embodiment of the specification.
In the foregoing embodiments, the descriptions of the respective embodiments have respective emphasis, and for parts that are not described in detail in a certain embodiment, reference may be made to the related descriptions of other embodiments.
The preferred embodiments of the present specification disclosed above are intended only to aid in the description of the specification. Alternative embodiments are not exhaustive and do not limit the invention to the precise embodiments described. Obviously, many modifications and variations are possible in light of the above teaching. The embodiments were chosen and described in order to best explain the principles of the embodiments and the practical application, to thereby enable others skilled in the art to best understand and utilize the embodiments. The specification is limited only by the claims and their full scope and equivalents.
Claims (14)
1. A method of root cause location, comprising:
acquiring flow change information of virtual machines in a virtual machine cluster at a fault time point;
screening candidate virtual machines from the virtual machine cluster according to the flow change information, and loading historical data of the candidate virtual machines connected with the fault time point;
determining abnormal information of the candidate virtual machine in a preset root cause positioning dimension according to the historical data;
determining a target virtual machine among the candidate virtual machines based on the exception information.
2. The method of claim 1, wherein the obtaining of traffic change information of virtual machines in a virtual machine cluster at a failure time point comprises:
determining the virtual machine cluster corresponding to the shared resource dimension, and reading the shared resource flow information of the virtual machine cluster;
calculating a cluster flow change value corresponding to at least one set time point of the virtual machine cluster according to the shared resource flow information;
and determining the fault time point in the at least one set time point according to the cluster flow change value, and acquiring flow change information of the virtual machines in the virtual machine cluster at the fault time point.
3. The method of claim 2, wherein the determining of the traffic change information of any virtual machine in the virtual machine cluster comprises:
determining a normal time interval and an abnormal time interval according to the fault time point;
acquiring normal flow change information of the virtual machine corresponding to the normal time interval and abnormal flow change information corresponding to the abnormal time interval;
and calculating a flow change value according to the normal flow change information and the abnormal flow change information, and using the flow change value as the flow change information corresponding to the virtual machine.
4. The method of claim 3, wherein the screening of candidate virtual machines in the virtual machine cluster according to the flow change information comprises:
calculating the ratio of the flow change value corresponding to each virtual machine to the cluster flow change value;
sorting the virtual machines in the virtual machine cluster according to the calculation result to obtain a virtual machine queue;
and selecting a set number of virtual machines in the virtual machine queue as the candidate virtual machines.
5. The method according to claim 3, wherein the obtaining of the normal traffic change information of the virtual machine corresponding to the normal time interval and the abnormal traffic change information corresponding to the abnormal time interval includes:
creating an information reading request according to the normal time interval and the abnormal time interval, and sending the information reading request to a log server corresponding to the virtual machine cluster;
receiving initial flow change information fed back by the log server aiming at the information reading request;
and determining the normal flow change information and the abnormal flow change information in the initial flow change information.
6. The method of claim 1, the loading historical data associated with the point in time of failure for the candidate virtual machine, comprising:
creating a data loading request according to the fault time point, and sending the data loading request to a database corresponding to the candidate virtual machine;
starting at least two threads in response to the data loading request, and receiving historical normal data and historical abnormal data fed back by the database aiming at the data loading request through the at least two threads as the historical data.
7. The method of claim 1, wherein the determining the abnormal information of the candidate virtual machine in a preset root cause positioning dimension according to the historical data comprises:
dividing the historical data according to the fault time point to obtain historical normal data and historical abnormal data;
determining at least one sub-root cause positioning dimension in preset root cause positioning dimensions, and calculating abnormal information of each sub-root cause positioning dimension according to the historical normal data and the historical abnormal data;
correspondingly, the determining a target virtual machine in the candidate virtual machines based on the exception information includes:
and integrating the abnormal information of each sub-root factor positioning dimension, and determining a target virtual machine in the candidate virtual machines according to an integration result.
8. The method of claim 7, wherein, in the case that the sub-root location dimension is a predicted root location dimension, determining the abnormal information of the predicted root location dimension comprises:
inputting the historical normal data into a pre-trained flow prediction model to obtain flow expectation information, and determining first flow real information according to the historical abnormal data;
and calculating deviation information between the flow expected information and the first flow real information to serve as abnormal information of the candidate virtual machine in the prediction root cause positioning dimension.
9. The method of claim 7, wherein, in the case that the sub-root location dimension is a comparison root location dimension, the determining of the abnormal information of the comparison root location dimension comprises:
generating an abnormal condition according to the historical normal data, and determining second flow real information according to the historical abnormal data;
and detecting the second flow real information according to the abnormal condition, and determining the abnormal information of the candidate virtual machine in the comparative root cause positioning dimension according to the detection result.
10. The method according to claim 7, wherein in the case that the sub-root location dimension is a similar root location dimension, determining the abnormal information of the similar root location dimension comprises:
acquiring a first resource change curve corresponding to the virtual machine cluster, and generating a second resource change curve corresponding to the candidate virtual machine according to the historical normal data and the historical abnormal data;
and calculating the curve similarity between the first resource change curve and the second resource change curve to serve as the abnormal information of the candidate virtual machine in the similar root cause positioning dimension.
11. The method according to any one of claims 7 to 10, wherein the integrating the abnormal information of each sub-root positioning dimension, and determining the target virtual machine in the candidate virtual machines according to the integration result, comprises:
calculating an abnormal score corresponding to each sub-root factor positioning dimension according to the abnormal information of each sub-root factor positioning dimension;
and integrating the abnormal score corresponding to each sub-root positioning dimension, and determining a target virtual machine in the candidate virtual machines according to an integration result.
12. A cause location system, comprising:
the storage node is used for acquiring flow change information of the virtual machines in the virtual machine cluster at a fault time point; screening candidate virtual machines from the virtual machine cluster according to the flow change information, reading historical data of the candidate virtual machines connected with the fault time point, and sending the historical data to a computing node;
the computing node is used for receiving the historical data and determining abnormal information of the candidate virtual machine in a preset root cause positioning dimension according to the historical data; determining a target virtual machine among the candidate virtual machines based on the exception information.
13. A server, comprising:
a memory and a processor;
the memory is for storing computer-executable instructions, and the processor is for executing the computer-executable instructions, which when executed by the processor, implement the steps of the method of any one of claims 1 to 11.
14. A computer-readable storage medium storing computer-executable instructions which, when executed by a processor, implement the steps of the method of any one of claims 1 to 11.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202211427061.7A CN115576732B (en) | 2022-11-15 | 2022-11-15 | Root cause positioning method and system |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202211427061.7A CN115576732B (en) | 2022-11-15 | 2022-11-15 | Root cause positioning method and system |
Publications (2)
Publication Number | Publication Date |
---|---|
CN115576732A true CN115576732A (en) | 2023-01-06 |
CN115576732B CN115576732B (en) | 2023-03-10 |
Family
ID=84589959
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN202211427061.7A Active CN115576732B (en) | 2022-11-15 | 2022-11-15 | Root cause positioning method and system |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN115576732B (en) |
Citations (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20070061792A1 (en) * | 2005-09-12 | 2007-03-15 | Oracle International Corporation | Method and system for automated root-cause analysis for class loading failures in Java |
CN104270416A (en) * | 2014-09-12 | 2015-01-07 | 杭州华为数字技术有限公司 | Load balancing control method and management node |
US20150178117A1 (en) * | 2013-12-24 | 2015-06-25 | Kt Corporation | Selecting cloud computing resource based on fault tolerance and network efficiency |
US20160139943A1 (en) * | 2014-11-13 | 2016-05-19 | Microsoft Technology Licensing, Llc | Virtual machine cluster backup |
CN109558216A (en) * | 2018-12-11 | 2019-04-02 | 深圳先进技术研究院 | It is a kind of that optimization method and its system are virtualized based on the single I/O migrated online |
CN111158977A (en) * | 2019-12-12 | 2020-05-15 | 深圳前海微众银行股份有限公司 | Abnormal event root cause positioning method and device |
CN112835662A (en) * | 2019-11-25 | 2021-05-25 | 深信服科技股份有限公司 | Virtual machine operation and maintenance method, system, equipment and computer medium under desktop cloud scene |
CN113590451A (en) * | 2021-09-29 | 2021-11-02 | 阿里云计算有限公司 | Root cause positioning method, operation and maintenance server and storage medium |
CN113746798A (en) * | 2021-07-14 | 2021-12-03 | 清华大学 | Cloud network shared resource abnormal root cause positioning method based on multi-dimensional analysis |
-
2022
- 2022-11-15 CN CN202211427061.7A patent/CN115576732B/en active Active
Patent Citations (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20070061792A1 (en) * | 2005-09-12 | 2007-03-15 | Oracle International Corporation | Method and system for automated root-cause analysis for class loading failures in Java |
US20150178117A1 (en) * | 2013-12-24 | 2015-06-25 | Kt Corporation | Selecting cloud computing resource based on fault tolerance and network efficiency |
CN104270416A (en) * | 2014-09-12 | 2015-01-07 | 杭州华为数字技术有限公司 | Load balancing control method and management node |
US20160139943A1 (en) * | 2014-11-13 | 2016-05-19 | Microsoft Technology Licensing, Llc | Virtual machine cluster backup |
CN109558216A (en) * | 2018-12-11 | 2019-04-02 | 深圳先进技术研究院 | It is a kind of that optimization method and its system are virtualized based on the single I/O migrated online |
CN112835662A (en) * | 2019-11-25 | 2021-05-25 | 深信服科技股份有限公司 | Virtual machine operation and maintenance method, system, equipment and computer medium under desktop cloud scene |
CN111158977A (en) * | 2019-12-12 | 2020-05-15 | 深圳前海微众银行股份有限公司 | Abnormal event root cause positioning method and device |
CN113746798A (en) * | 2021-07-14 | 2021-12-03 | 清华大学 | Cloud network shared resource abnormal root cause positioning method based on multi-dimensional analysis |
CN113590451A (en) * | 2021-09-29 | 2021-11-02 | 阿里云计算有限公司 | Root cause positioning method, operation and maintenance server and storage medium |
Non-Patent Citations (2)
Title |
---|
SHIZE ZHANG; YUNFENG ZHAO; JIANYUAN LU: "CloudPin: A Root Cause Localization Framework of Shared Bandwidth Package Traffic Anomalies in Public Cloud Networks", 《IEEE》 * |
程云观等: "一种云环境下的高效异常检测策略研究", 《计算机应用与软件》 * |
Also Published As
Publication number | Publication date |
---|---|
CN115576732B (en) | 2023-03-10 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2018072711A1 (en) | Distributed FP-Growth With Node Table For Large-Scale Association Rule Mining | |
US20190279088A1 (en) | Training method, apparatus, chip, and system for neural network model | |
US11240121B2 (en) | Methods and systems for controlling data backup | |
US20150278706A1 (en) | Method, Predictive Analytics System, and Computer Program Product for Performing Online and Offline Learning | |
WO2019180433A1 (en) | Predicting using digital twins | |
WO2022001918A1 (en) | Method and apparatus for building predictive model, computing device, and storage medium | |
WO2019184836A1 (en) | Data analysis device, and multi-model co-decision system and method | |
CN111314121A (en) | Link abnormity detection method and device | |
WO2024104401A1 (en) | Cloud network abnormality detection model training method based on reinforcement learning, and storage medium | |
CN111475584A (en) | Data processing method, system and device | |
US20240095529A1 (en) | Neural Network Optimization Method and Apparatus | |
Natali et al. | Online time-varying topology identification via prediction-correction algorithms | |
CN107871055B (en) | Data analysis method and device | |
CN108470251B (en) | Community division quality evaluation method and system based on average mutual information | |
CN117290719A (en) | Inspection management method and device based on data analysis and storage medium | |
CN115576732B (en) | Root cause positioning method and system | |
CN117371508A (en) | Model compression method, device, electronic equipment and storage medium | |
WO2023093431A1 (en) | Model training method and apparatus, and device, storage medium and program product | |
Tang et al. | Tackling system induced bias in federated learning: Stratification and convergence analysis | |
CN116668264A (en) | Root cause analysis method, device, equipment and storage medium for alarm clustering | |
CN115629883A (en) | Resource prediction method, resource prediction device, computer equipment and storage medium | |
CN115774602A (en) | Container resource allocation method, device, equipment and storage medium | |
CN111343664A (en) | User positioning method, device, equipment and medium | |
CN114168589A (en) | Index construction method and device | |
CN112905457A (en) | Software testing method and device |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
PB01 | Publication | ||
SE01 | Entry into force of request for substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
GR01 | Patent grant | ||
GR01 | Patent grant |